1. Business Continuity A matter of survival Session 3 The Business Impact Review

2. Stage 1 - Business Impact Review
Topics covered -
preliminary work
Business Impact Review
report to management

3. Phase 1 : preliminary work
Gain top management support -
raise awareness
obtain initial budget
Undertake survey : identify -
processes
locations
personnel to interview
Write survey report -
review boundary
personnel, budget and time-scale
recommend corporate policy

4. Phase 2 : Business Impact Review
Objectives are to identify -
key business processes
nature of threats
impact of service failure
growth of impact with time
maximum ‘tolerable’ time to resume -
emergency service
full service
estimated recovery requirements
areas for improved risk reduction
What are the risks?

5. Hard and soft impacts Hard impacts - Soft impacts -
financial loss (repair/replacement)
reduced revenue
increased costs
penalties (fines, breach of contract etc)
Soft impacts -
loss of goodwill & credibility
embarrassment
personal safety
operational capability

6. The time factor Consider growth of impact with time -
< 15 minutes
1 hour
12 hours, etc etc
Group systems : to be recovered in -
‘n’ hours - category 1
‘n’ days category 2
‘n’ weeks - category 3
‘period dependent’ - category 4, etc. etc.

7. Growth of impact with time
$M - cum.
marginal loss
Process A
Process B
10M
Process C
Process D 5M
2 days
1 week
1 month
2 months
1 day

8. Impact assessment
Social security system : consider impact(s) of increasingly serious failures in systems processing -
claims for state pensions and benefits
collecting insurance contributions
social security payments
recovery of loans
accounts
planning/statistics
personnel/payroll
suppliers’ bills
voice, fax and

9. Reporting to management
Findings and recommendations -
systems to protect
estimated resource needs for emergency services
areas for improved risk reduction
refinement of corporate policy
Plans and resources for next stage of the project
continued

10. Reporting to management (con’t)
As appendices, a separate summary for each system reviewed :-
business consequences of outage (net cost, loss of goodwill, political, legal, etc)
likely growth with time
maximum tolerable time to recover -
emergency service
full service
the minimum resources needed to provide an acceptable emergency service
opportunities for improved risk reduction

11. Summary Gain top management commitment Survey - scope problem
Business impact review -
consider system outage over stated periods
identify related business impacts
rank systems in order of criticality
estimate resources for emergency service
opportunities for improved risk reduction
estimate resources for next stage of project
Report findings to management